A digital forensic tool is focused on data collection and analysis and thus, does not provide a method of effectually expressing data. Therefore, to more efficiently transfer information to a user, forensic data needs to be embodied to include effectual information using a data visualization scheme.
Forensic data that may be a target to be visualized includes computer forensic data, portable forensic data using an external storage device such as a universal serial bus (USB), mobile device data including a smart phone, social network service (SNS) forensic data, and the like.
Collection of raw data for visualization of forensic data may be performed with respect to a variety of data from different types of sources. A plurality of data may be collected for each user even with respect to the same source. Even though data is collected from the same source, the collected data may have a different format based on a used collection tool.
Various correlations exist between data that is collected from a plurality of sources and has various formats. In order to analyze a forensic investigation or a user behavior, it is very important to visually express the various correlations. However, an existing forensic tool or forensic visualization tool does not provide a method of expressing the various correlations. Accordingly, an existing visualization method provides a method of expressing only data collected from a single source and has difficulty in mixing and thereby expressing data collected from a plurality of sources. In order to analyze an effectual forensic investigation or a user behavior, it is necessary to visually express individual data collected from a single data collecting source. Multiple data collected from multiple data sources also needs to be visually expressed, however, the existing forensic visualization tool has some constraints.